Unlike a Win32 application that has a password control in the GUI application which a Black Box can recognize; the Black Box does not have a way to distinguish different controls in an HTML page and automatically mask the keyboard input.
To avoid capturing the password you will need to:
1) Mask all key strokes in the RPR file
1a) RPR Editor --> User & Resources tab --> check Mask key strokes checkbox
2) Turn off GUI operation capture in the RPR
2a) RPR Editor --> User & Resources tab --> uncheck Record user Operations checkbox